nhs – Terence Eden’s Blog

Responsible Disclosure: Joiners, Movers, and Leavers in NHS BSA

@edent — Tue, 02 Dec 2025 12:34:08 +0000

Many many years ago, I did some work for the NHS. As part of that, I was given access to certain GitHub organisations so that I could contribute to various projects. Once I left that job my access was revoked.

Mostly.

A few weeks ago, I received this email from GitHub.

On the surface, this is a sensible email. They want all their members to only have strong 2FA and I still had SMS configured as a fallback method. Except, of course, I should not be a member. I should have been kicked out when I handed back my laptop and lanyard. There was still a bit of pandemic pandemonium about - but surely in the last few years someone should have audited the organisation's membership?

The JML process is critical to cybersecurity. There's no point having fancy controls if you don't revoke the permissions of people who are no longer entitled to access. On a fully integrated system this is (usually) easy - untick a box on Active Directory or whatever and *poof* the user is banned.

But with external systems the problem is harder. You now need to keep track of external usernames, synchronise them with internal names, periodically check them for updates, integrate with an API, and - in some cases - take manual action. It's clear that this particular bit of the NHS had slipped up. Looking through the private list of collaborators, there were many old accounts.

I was able to see all private collaborators:

I could see all private repositories:

I even had access to create new repositories - including special ones:

To be abundantly clear, there was no medical data on GitHub. There was no patient data available for me to view. Absolutely nothing medically sensitive was stored there. This isn't a GDPR or medical privacy issue. If I had made any changes to the code stored on there, it would never have made it to production. There were no API keys or sensitive data or passwords for me to exfiltrate. The NHS BSA is a business unit - not a medical unit.

Nevertheless, it is important that all parts of a large organisation are able to quickly and competently remove users once they have left.

Timeline

2025-10-17
- Received GitHub email.
- Visited https://www.nhs.uk/.well-known/security.txt to get details of how to raise security issues.
- Raised the issue on HackerOne
2025-10-21
- After triage, the issue was assigned directly to the BSA.
2025-10-31
- I was removed from the organisation.
- Requested permission to publish this post. No objection received.
2025-12-02
- Published

Book Review: This Might Surprise You - A Breast Cancer Story by Hayley Gullen ★★★★★

@edent — Thu, 25 Sep 2025 11:34:17 +0000

My pal Hayley has written a book - a graphic memoir about dealing with breast cancer. Graphic as in graphic-novel - although there are a large variety of sketched boobs dotted throughout the pages and some frank discussions of sex. I'm not very good with "medical stuff" - so I was quite proud of myself for only twice needing to take a break from reading it because I felt faint.

It is the most perfectly human book I've read in a while. The inner monologue will be intimately familiar to anyone who has sat nervously in a hospital waiting room. It is in turns funny, heartbreaking, devastating, and hopeful. The illustrations are lush. Soaring between the mundane nature of being stuck in a machine, to the surreal nature of your body conspiring against you. It expertly mixes the factual (what to take, when to take it, where to go) with the fanciful (how to visualise your oncologist catching you with a butterfly net).

This book is vital reading for anyone involved in the NHS. It presents a ~~patient-~~ person-centred view of everything that can go wrong on a ~~patient's~~ person's journey through the health system. From technobabbling doctors to outdated IT systems. It's a clear and punchy call for improved holistics. Every part of the system matters - especially when ~~patients~~ people are at their most vulnerable.

In a delightful meta-narrative, the book passes the eponymous Gullen-test which asks whether a character with cancer is cured by normal science or a miracle. In this case, it is lot (and lots) of drugs, machines, doctors, nurses, and chemicals.

People with cancer get bought a lot of books. This is a tight 180 pages exploring the melancholy and the joy which can accompany the journey.

Highly recommended.

Technical Details

This part is more of a technical review of the eBook. Firstly, it's all in black and white - which makes it suitable for reading on an eInk device.

It's also available as an ePub - rather than just a flattened PDF. That means the text is selectable, available for screen readers, and searchable.

The book weighs in at 156MB, which is a bit chunky and will be slow to open on some eReaders. The images are all 1134x1700 resolution which makes them gorgeous to look at. But they're saved in the rather inefficient JPEG format, at extremely high quality. Shifting the images to PNG would have reduced the filesize by at least a third, with no loss of quality.

Bafflingly, the publisher has fixed the height and width of every page using:

That's approximately the right aspect ratio, but far too small. Some eReaders will display the pages in a small box on the page, others might be prevented from zooming in. The CSS is also weirdly bloated and could do with being optimised.

None of this will spoil your enjoyment of a very fine book. It's just evidence that some publishers need to get better at the technical aspects of graphic novels!

The NHS shouldn't outsource its QR codes

@edent — Tue, 03 Jun 2025 11:34:04 +0000

QR codes are brilliant. They're a simple way to allow users to easily and quickly go to the right URl - no matter how complex. No more worrying about typing in long addresses or figuring out if that's a letter O or the number O. Scan and go!

The best thing about QR codes is that they're free. It doesn't cost any money to generate one. They're an open standard with no middle-men. Users can go direct to your site!

Except… Some people want to insert themselves into your conversation. Sometimes it is for malicious reasons, sometimes it is greed for user data, and sometimes it is just incompetence.

Let's take this example - a health centre wants people to register. Scan the QR and get started. Fab!

Photo shamelessly stolen from a LinkedIn contact.

But what happens when you scan the QR code? Rather than taking you directly to an authoritative and trusted NHS.UK domain name, it sends you through https://register-with-gp.ht1.uk/.

Who on earth are HT1.UK?

According to their website, they're an automation company who are "on a mission to make the NHS the most advanced healthcare system in the world."

Good for them. But what information are they collecting about users who traverse through their QR codes? If you take a look at their privacy policy you won't find anything specific. Never mind, let's email their friendly privacy team. What's their email address?

Of course, emailing that gets you back this error:

Emoji! How fun!!

So I emailed the new address to see what information they were collecting. Their response wasn't particularly informative.

because Healthtech-1 is a processor of information and the GP practice is the data controller any requests about how your data is handled should be made to the GP practice who can inform you of the information you requested.

…

I can confirm that there is no information stored about users who scan the QR codes and no cookies placed.

But, of course, users have no way of verifying what this company is storing about them. There's simply no reason to use an untrusted 3rd party like this to provide either a QR code or an intermediary website.

Why this is a problem

Trust is everything. People are constantly being scammed. One of the great things that GOV.UK did was to say "This here is our trusted brand. If you don't see GOV.UK in the URl bar - don't trust it!"

The NHS should be doing the same. Every hospital, surgery, and clinic should have an NHS.UK domain name. When a user sees a link to a healthcare service which doesn't go through NHS.UK, they should feel suspicious and not click on it.

There is no way as a regular user to know that HT1.UK is a trusted domain. What about HT1.biz? HT2.UK? NHS.info.ly? What happens if HT1 go bust or have their domain name hijacked?

The NHS must stop the proliferation of these 3rd party domain names. They need to reinforce users' understanding that NHS.UK is the only trusted domain name for official NHS services.

I'm sure HT1.UK aren't doing anything nefarious with the data of people who visit their QR codes. I'm sure they're not inserting tracking cookies or selling my data. But I shouldn't have to be sure. All users should be pointed directly to an NHS.UK domain without having to risk whether their details are going via a dodgy site.

Here endeth the rant.

You can outsource risk, but you can't outsource reputation

@edent — Thu, 20 Jun 2024 11:34:22 +0000

Over the last few weeks, I've had several people ask me about the recent hack on the NHS. A ransomware attack has meant that several hospitals have cancelled operations and there is now an urgent demand for blood donors. What does it say about the state of NHS IT that this attack has happened?

Nothing.

Because the NHS was not hacked.

Instead, a company they use to perform blood tests was attacked. Synnovis is the company responsible - they're the ones who have fallen prey to an attacker. This private company - will all the resources of the free-market system - hadn't protected themselves well enough.

I'm perfectly comfortable with the NHS buying things from private companies. The NHS doesn't need to write its own webserver software. There doesn't need to be a state-owned factory which produces "medical grade" ballpoint-pens. And, yeah, if a private company can run blood tests faster and cheaper - it might make sense to use them.

But the problem with outsourcing is that your customer doesn't understand the way your organisation is organised. I once worked for a telco who outsourced their customer service helpdesk. The shitty call-centre we used saved them a lot of money but dragged their reputation through the mud.

Similarly, here's a story in the Telegraph about the attack:

As ever, the real story is in the penultimate paragraph. You have to read all the way through to see it wasn't the NHS being hacked.

Go through other news stories on the subject and see how clear they make it that it isn't the NHS who have been hacked.

If your website goes down, do your users care whether its technically an outage at your 3rd party CDN? When your customers' credit card details are leaked, do the headlines mention your name or your payment provider's? Which bits of your reputation do you feel like handing to other people?

If you're able to, please donate blood.

Nurses should spend less time helping patients and more time ordering bandages

@edent — Mon, 07 Aug 2023 11:34:13 +0000

I was speaking to the absolute epitome of a pub bore. Flapping his jaws about how the problem with the NHS was too many admin staff doing absolutely nothing.

"Quite right!" I said, feverishly agreeing with his red-faced ranting, "Nurses should spend less time helping patients and more time ordering bandages!"

He paused, slightly, as the gears in his brain started grinding. "Well, no, not like that. Obviously."

I agreed again, "Too true. Doctors shouldn't be installing computers either. They should be co-ordinating those who install computers."

He spluttered, "You're twisting my words!"

But was I? Really?

I'm sure there is some waste in the NHS. There's waste in all organisations. But most of what people think of as bloated middle-management is the boring work of keeping an organisation running.

Once an organisation gets beyond a certain size, it needs people to help manage the organisation itself. I've worked at a startup where the engineers had to take time out of their day to build desks because the CEO didn't have enough cash to pay for delivery and assembly. I've been at corporates where managers spent about a day a week approving timesheets and running payroll - because a professional payroll department was too much of an overhead. Memorably, one company announced that they were getting rid of the tea-ladies who carted around an urn and selection of cakes - rather than having a cuppa at their desks, people left the building for half an hour on a group beverage run.

In all those cases, relentlessly focussing on the "core" mission had a moderate to severe impact on delivery.

Should we try to reduce the unnecessary administrative burden and overhead of our processes? Yes! That's an undoubted good idea. But what is "unnecessary"?

Here's the part where you tell me that the NHS shouldn't be providing... oh... I don't know... racial sensitivity training or coloured lanyards or pagers. Fine. Whatever. You have your bugbears and I have mine.

But the inescapable facts are that non-frontline services need to be performed to support the frontline. Without a payroll team to ensure people get paid, even the most dedicate nurse won't stick around for long. Without someone to tell the cleaners which toilets need cleaning, and researching the most cost effective way to buy bleach, and dealing with the fallout when there's interpersonal conflict - the dirt piles up and people get sicker. Without someone forecasting bandage use, the optimal number to have in storage, the rotation of stock, monitoring the quality of goods delivered - you end up with insufficient bandages or paying too much to store bandages.

Just because you don't understand how the world works, doesn't mean the world doesn't work properly. And just because the world is broken, doesn't mean it is broken in the way you think it is.

That costs the same as five nurses!

@edent — Thu, 25 May 2023 11:34:56 +0000

Tom Dolan has an excellent blog post which touches, in part, on comparative cost.

If you're working for, say, a TV company - then you know exactly how much an hour of TV programming costs on average. If you want to do something like build a website, it's quite natural for people to evaluate its budget in terms of how many hours of TV it costs.

That can be a useful metric. It allows people to benchmark the impact your non-core project is having against the investment. But, in my experience, it can also be toxic.

One of the challenges I faced when working with the NHS was that lots of people view the health service only in terms of Nurses. And any change that you propose will instantly be compared with a Nurse's salary.

It's disturbingly easy to say "We need a new payroll system? But that will cost the same as ONE THOUSAND NURSES!"

But, of course, without a proper payroll system you will have zero nurses. And - whisper it - one thousand nurses isn't a huge number in context of the total number of nurses in the UK.

Now, don't get me wrong; I love nurses. But the NHS is also doctors, porters, receptionists, cleaners, and many more people. It is also buildings, TV screens, MRI machines, door handles, and scalpels. The NHS is computer systems, hardware, software, cloud processing, and giant stores of data.

Should we have more nurses? Yes! Should they be paid better? Yes! Can we improve the NHS without capital investment in technology? No!

Technology should be a generator of efficiencies. I'm aware that's not always the case and that a mismanaged project can be worse than no project at all. But comparing every piece of technology to a nurse's salary is an emotional sleight of hand which prevents any progress.

Poorly folded letters lead to exposure of medical data

@edent — Tue, 03 Jan 2023 12:34:04 +0000

I returned home from holiday to a pile of letters. Mostly junk, a few Christmas cards, and something from the NHS.

This is what the envelope looked like:

As it happens, I'm not particularly concerned about who knows I had a fairly normal medical procedure. I've blogged a bit about it and Tweeted about the experience in an attempt to de-stigmatise it.

But there will be plenty of people who are mortified that their postie knows that someone shoved a camera up their bum. Or that other people living in their home know that their guts are playing up. I'm sure you can imagine a worst-case scenario.

There are several ways to prevent this - each with potential drawbacks:

Use a cover sheet which only has the address on. Will this double the cost?
Print the address on one side of the paper and the letter on the other side. How does that test with users though?
Don't use a windowed envelope and print the address separately. Are there cost implications?
Ensure that the first few lines don't contain any sensitive information. How can that be enforced?
Manually check outgoing letters to ensure they're compliant. Again, what's the cost of that?

I'm sure you can think of a few more. Some people have even tried to standardise this:

Thankfully, the letter told me that I didn't need an additional screening. Which was something of a relief.

Now, if you'll excuse me, I need to find the Data Protection Officer and become a pain in their arse!

Giving Blood - Part Ⅲ

@edent — Tue, 14 Dec 2021 12:34:56 +0000

Last time it was a mid-pandemic trip to a giant shopping mall. This time, a pre-Xmas trip to a youth centre. Glamorous! I always feel slightly boring when I answer the pre-donation questionnaire. No, I haven't been travelling to exotic locations, having sex with multiple strangers in exchange for drugs and money. I could blame lockdown, but it's unlikely I'd be doing those things anyway!

Bit of an odd one this time. My blood was too "fizzy" to do the iron level drop - so they had to do it the old fashioned way. Then it turned out that my veins were too "flat". No idea what that meant, but a different nurse was able to exsanguinate me properly.

And then, the machine wouldn't stop bleeping. Apparently my flow was too low. So I raised my heart rate by thinking of exciting things. Like tonight's episode of Doctor Who!

The best thing about donating isn't the free drink (delicious purple flavoured isotonic water) nor the free snacks (crisps, chocolate, or popcorn this time) but the high-quality free stickers!

And so another 470㎖ of the good stuff is sent off to the bank. If you need blood in the next few weeks, I hope you will enjoy some organically-reared, vegan-fed, cruelty-free blood on me ☺

Vax³💉💉💉

@edent — Sat, 11 Dec 2021 12:34:11 +0000

I am in awe of how simple the booster shot booking process was. I visited the site on my phone while in bed and hungover, typed in my NHS number, confirmed a few details, and it listed a pharmacy a 20 minute walk away as having appointments.

A couple of weeks later and my 2xAZ was supplemented with 0.5x Moderna / SpikeVax. What a cool name - my inner Buffy fan is very happy to have been "Spiked" 🧛

Not quite early enough to be fully boosted for Xmas party season, but there's a limit to how much over-priced half-baked veggie fare I can eat.

As with my previous two jabs, I got them done on Friday afternoon so that I could spend the weekend suffering. I'm sure my work wouldn't have minded me taking some time off to recover, but I know I'd feel guilty about sitting on the sofa while my colleagues cover for me.

I gave blood last week. So I wonder if that means the vaccine is now extra concentrated in my bloodstream and I'll get superimmunity? The nurse administering the jab didn't seem to think so…

I guess the real question now is - how many more? I already had my flu jab a few months ago. Is there a limit to the number of vaccines a person can have? Can we be loaded up with hundreds of mRNA vaccines at once?

I've spent the last two years basically not being ill. Well, other than a brief bout of an upset stomach. No sniffles, no hacking up phlegm, no sore throats, no debilitating headaches. I could get used to this! But I wonder if that will affect my immune system? No lurgy in two years - does that mean the next thing to make it through my mask is going to knock me flat?

I suspect that I'll start going back into the office on a regular basis at some point early in the new year. But, for now, I'm safe in my little bubble - watching the world go by my window.

Three Things I Wish I'd Known About NHS Technology

@edent — Thu, 12 Aug 2021 11:36:37 +0000

It has been a year since I stopped working for NHSX. A few weeks ago, someone reached out to me inquiring about a job there. They wanted to know what they needed to know before joining. As well as the normal moaning about the quality of vending machine coffee, I told them about three things which caught me off-guard when I joined.

So, here for your edification, are three things I wish I'd known about NHS technology before I joined...

The NHS Doesn't Exist

I often tell people that the NHS is a figment of their imagination. When I say this, I don't mean "the NHS doesn't exist". I mean "the NHS doesn't exist".

Health is a (mostly) devolved competency - which means there is no single NHS for the UK. Within England, you have local responsibilities, Clinical Commissioning Groups (CCGs), and a whole host of other organisation. Then there are national bits of the NHS like NHS Digital, or NHS Blood and Transplant. But it is a mish-mash of (brilliant) organisations.

Here's an explainer video which I found pretty useful:

The NHS is a federation of different groups, with their own priorities and budgets. If you were to design a healthcare system from scratch, you probably wouldn't end up here. But, understandably, it would be impractical to restart the entire infrastructure from scratch.

The NHS has a lot of private organisations serving it

I'm not making political commentary here; I'm stating a fact. There is no big NHS-owned factory which produces bandages and scalpels. Hospitals buy equipment from private suppliers. A GP's surgery is a private organisation (usually) owned by the doctors. You may have feelings about whether this is sensible. But, again, it is where we are at the moment.

Similarly, the NHS doesn't manufacture computer hardware - it buys it. The same is mostly true with software. There are some things that only the NHS needs, and so it designs and builds the software itself. But most software programs - be they payroll systems or the canteen menu printer - are bought from the market.

Should the entire NHS use a single piece of software to do XYZ? Or should each hospital be free to buy anything it likes to do XYZ?

The above two points are both a feature and a bug. Is it annoying and confusing to have to do things multiple times? Yes. Does it prevent breaking changes from causing lasting damage to the system? Also yes. Monocultures are efficiently dangerous.

The NHS Can't Move Fast And Break People

The NHS is a risk averse organisation. When introducing a new technology, you need to be prepared to answer the question "how many people will this kill?"

When Facebook updates its UI, that's annoying. When the clinically critical system a doctor uses every day to keep people alive changes the order of its buttons - that's an unacceptable risk. That's why lots of health systems don't receive an update once deployed. Training people costs time and money - and introducing change introduces confusion. Tired and stressed healthcare workers don't want to fart around with a new UI every five minutes.

Similarly, back end changes need to be justified in terms of risk. The existing system may not be perfect, but people know how to manage its risks.

Rolling out technology changes have to take into account all three of these points. It isn't enough to say "this tech is good enough YOLO!" You have to get buy in from multiple stakeholders, some internal, some external, some with contradictory needs. You need to ensure safety and value for money, for both the short- and long-term.

What else?

There are many other things I wish I'd known (buy me a drink in a pub some day!) but those were the three which stood out for me.

Things are changing. Sometimes they change more slowly than technologists would like and far too quickly for patients and healthcare workers. The NHS is a wonderful organisation - and they're hiring! - but it is a complex beast with equally complex needs.

Vaxed and Waxed

@edent — Sat, 12 Jun 2021 11:42:38 +0000

Nine weeks ago, I got my first does of the AZ vaccine. Yesterday, I received my second.

Despite all the dire warnings of overloaded websites and limited slots, the booking process was boringly anticlimactic. I entered my NHS number, date of birth, postcode - and was then given a choice of locations. I picked one, and was given a range of times. I picked one for a few days hence and my wife - on the computer next to me - picked hers for five minutes later.

Only after booking did we bother to check whether the trains would get us in on time. D'oh! But all was fine.

A trundle to the station, a walk to the pharmacy, a quick check of my details, jab, and home again.

The last vaccination knocked me out for a full day, so we booked for a Friday afternoon. I'm sure I could have taken a few days off from work if I needed - but it isn't like my weekends are full of exciting adventures.

And now what? We're slowly been reintegrating ourselves back into society. A walk through town here, a drink with friends in a park there, even a visit to a local pub. It has been 16 months of lockdown for us.

Should I immediately fill my social calendar with engagements? Spend every waking hour stuffing my senses with pleasure in order to make up for a lost year? No. I think I'll take it slow. Start to see a few local friends. Brave a nice restaurant. Nothing too radical.

To start, I'm going to buy some beard wax to style my hirsute face (what else did you think "waxed" referred to?!?) and start to groom myself into a reasonable facsimile of a normal human being.

But, first, a weekend of feeling like crap and eating comfort food.

Excel as a mapping tool

@edent — Fri, 23 Apr 2021 11:23:19 +0000

About a million years ago, my wife's work sent her on a training course optimistically titled "How To Use Excel As A Database."

We were both horrified. Excel is a perfectly good spreadsheet program - but it is categorically not a database!

OK, it has rows and columns which sorta look like a database table. And you can put constraints on cells which mimic a schema. And, yes, you can sort and query data. And you can join data across multiple tables. And... you know what...? Excel is a pretty decent visual introduction to databases. Sure, it isn't ACID and you wouldn't want to run a production environment off it. But Excel is a reasonable introduction to some database concepts.

My wife had to visit a hospital recently for a COVID test. Hospitals are often large and confusing buildings. But the hospital's website had a handy "Click here for a map" link. She clicked it, and I heard her scream from across the house.

What?

WHAT?!!?

Yes, some enlightened person had decided to use Excel to draw a building map... I can't even...

There are many reasons why this is bad. A user might not have Excel installed on their phone. The thin grey lines are easy to confuse with thick grey lines. There's no way to see entrances. The plain text means it doesn't have familiar icons for toilets. I'm sure you can think of a dozen more reasons.

And yet... It was probably easier to get permission to install Excel on a machine than it was to procure a specialist graphics tool. Just about anyone can use Excel to draw boxes without training. It's easy to edit if a room is closed or changes function. The text is searchable, unlike a graphic. It doesn't overwhelm the user with colours and extraneous information. At 41KB it's easy to download over a crappy WiFi connection.

As a quick hack, to get a vaguely usable map up on the website, Excel is... well, it isn't fine. It is barely even adequate. But it fulfils the brief. I hope that this was a quick bodge done one day with the aim of fixing it later. But, 7 years later, it is still there. Do people complain, or do they sigh and move on?

Or am I wrong and Excel is the perfect tool for the job?

You can see people's reactions to this map in the following Twitter thread.

Weeknotes: Vaccinated - Part 1

@edent — Fri, 09 Apr 2021 11:45:02 +0000

I know exactly what I was doing on 9th April 2020. I was worrying about open-sourcing the NHS Covid Tracing app. I was worrying about tech standards for booking test slots. I was worrying if I'd ever see my family and friends again. I was worrying if the NHS websites would contain enough semantic HTML to be useful. I was worrying if the security of 3rd party sites was up to snuff. I was worrying about the Inevitable Pubic Inquiry. I was worrying worrying worrying late into the night.

I know exactly what I was doing on 9th April 2021. Shortly after midday, a lovely NHS worker jabbed me in the arm, and filled my veins with an efficacious cocktail of... Well, let's just agree to call it magic, eh?

Sure, there will be a few days of feeling rough. And there's a few weeks until immunity kicks in. And a few months until the second dose. And a few more until we can all go to the pub and toast our missing friends.

But, for the first time in over a year, I can feel my worry easing.

You have no idea of the changes which are coming

@edent — Sun, 20 Sep 2020 11:22:54 +0000

I wrote this before the pandemic. I chickened out of publishing it because I was working for NHSX at the time. Some of these things have come to pass. Some are yet to come.

I'll never forget the look of horror on my professor's face when I told him I didn't think his university course was good value for money.

I was in the first cohort of UK students paying tuition fees. A massive £1,000 per year. A group of us had gathered to complain about the poor quality teaching materials on a specific course, the lack of contact hours, and decrepit facilities.

Value for money and - by extension - user choice, was an alien concept in undergraduate education. We weren't humbled by wise old men - we were paying a significant sum of money for a resource.

I went back to my old university a few years ago. The crappy computer labs have been upgraded, lecturers seem more engaged with students - rather than treating them as a distraction from research, and the students are more confident in demanding what they need.

A large part of this is because prospective students aren't choosing a course based on which campus has the cheapest beer any more. They're on social media talking to existing students, they're looking up the salaries of graduates, they're investigating the ratings of professors. If you were paying £9k, wouldn't you do the same?

That conversation was 20 years ago. Fuck. I'm old.

But the same conversation has been and gone with swapping energy providers. I was bemused when we moved into our new house to discover that the previous owners were stuck on the most expensive tariff from a company which took 30 minutes to answer the phone. Sure, not everyone cares about switching to the best deal, but within 15 minutes I saved £100s and swapped to somewhere with better customer service.

Like millions of people in the last few years, I've fired my phone provider. I recently told my bank to improve their services or I'd switch to one of those fancy app-only banks.

Nearly every service in the UK has undergone a radical transformation due to digital disruption. Users' expectations have been raised for quality and value for money.

Now the same transformation is coming for healthcare.

My local village pharmacy was crap. They were slow, inefficient, never answered the phone, and were downright rude. OK, their prices for an NHS prescription were identical to every other pharmacy - but I didn't feel like their service represented value for money.

I could have taken a bus to the nearest town and got my drugs from there - I'm lucky to have the mobility and money to do so. Instead, I swapped to an app-only pharmacy.

Echo post out my meds with no delivery charge. They send me reminders when they reckon I'm running low. If I'm away from home, they'll deliver to me. They don't shout out in a crowded shop "MR EDEN? YOUR EMBARRASSING OINTMENT IS READY!"

All I needed was a smartphone and an Internet connection.

I appreciate not everyone has these things. And not everyone trusts online services. That's fine. But most adults do. And there will suddenly be a tectonic shift when people realise that there is a better way of doing things.

The same is true of a regular GP visit. Do I want to sit on an uncomfortable chair, surrounded by ill people, waiting for hours because the previous appointments have been delayed? I might not be able to physically reach a different practice - even if their chairs are comfier - but I can swap to an online GP.

OK, a video chat isn't going to take my blood-pressure or hear my heartbeat - but it is great for a whole range of appointments. And if I don't want to look a doctor in the eye - due to anxiety, embarrassment, or even just time constraints - I can text chat.

I think every GP should have the best equipment, the fanciest chairs, the politest and least-stressed staff, super-fast computers, and plentiful appointments. They should all have amazing pharmacists who are discreet and caring.

But I'd still switch to something which was more convenient to me, better met my needs, and gave me an experience which I thought was higher quality. I suspect many people would.

This is the change that's coming. And it reveals some interesting questions:

What happens to a GP surgery when the built-in pharmacy doesn't have enough customers to stay profitable?
If "simple" consultations are replaced with video-chat / triage, does that leave more resources for others?
Do certain GPs want to work in an area with low / no digital take-up?
How many patients care about seeing the same doctor each time? Is that easier or harder via digital technologies?
We used to have doctors which made house-calls. Now they can do so virtually, what new skills do they need?

And, the big one:

What user needs are unfulfilled?

Ten years ago, no one wanted an app-only bank. The world has changed. And that change is coming for you!

Doesn't everyone have unlimited data?

@edent — Fri, 20 Mar 2020 12:12:34 +0000

One of the (many many many) things our team worked on this week finally went live:

All the UK's major mobile networks have zero-rated access to NHS websites.

Almost immediately, I had people telling me this was a pointless endeavour - because everyone has unlimited data on their phones. Right?

WRONG!

The UK communications regulator, Ofcom, regularly publishes detailed statistics about the mobile market. The latest report gives us the state of mobile usage until the end of 2018.

28% of subscriptions were pre-pay.
Out of bundle data charges raised £1.64 billion in revenue.
13% of all data was from pre-pay users.

Although most pre-pay bundles have limited data - not all do. Some offer unlimited data. And some pay-monthly SIMs have small data allowances.

It's important that we make decisions based on data - not gut instinct.

There's an important argument to be made about Net Neutrality - but, for now, money should not be a barrier to accessing healthcare information.

NHS Hack Day

@edent — Tue, 18 Jun 2019 11:34:06 +0000

It has been about 6 months since I started my new job at NHSX - I've loved getting stuck in to the Health Service culture. But there was one thing I was missing... a decent hack day!

I was delighted to get a ticket to NHS Hack Day. This is a quick post about the event, and what I learned.

What's the point of a hackday?

There were three common reactions from people when I said a bunch of geeks were going to an NHS Hack.

Ah! But the real problem is [some incredibly complicated thing] - please can you fix that?
OMG! Don't build anything fun! Isn't the NHS too important for that?
WTF? Are you using private patient data in your hacking?!

To answer these points in order

No. A weekend hack is suitable for building a sketch of something which might be useful. We can't fix systemic issues overnight.
No. Hackdays are about fun. Sometimes building something silly is the best way to demonstrate a point. We can only explore through creative play.
No. No one had access to private data. There are some public APIs which give things like waiting times, and prescription levels, but nothing sensitive.

We need to get better at explaining what the aims of a hackday are.

What worked

This was such a well organised event! Even had plenty of vegan food! Strong WiFi, decent seating and desks, and plug sockets everywhere.

Some of the hacks demonstrated were incredible. Everything from computer vision to online forms.

But, the best thing? The wide range of people! Need an epidemiologist? She's right over there! Want an API developer? Here's a couple! A great mix of ages, genders, skills, and backgrounds. It felt really well curated.

What didn't

Not much to complain about, so here's some constructive criticism. All minor points.

Make the 2nd day shorter. The event wrapped up at about 17:30. That's a little late on a Sunday, especially when people have work or school the next day.
Food was great, but the only thing to drink was coffee or tea. Luckily there was a supermarket nearby for some fruit juice and fizzy pop.
Because the teams were all in little rooms, it was hard to mix ideas and seek help. While big rooms are noisy, it does give you a chance to shout out "anyone here know Python" and get some help if you need it.

Result

We came second!

Winning a set of EXCLUSIVE t-shirts!

We developed an Alexa skill which could answer questions about hospitals like "what's the waiting time", "is there car parking", and "what rating is the hospital". Additionally, it could also answer questions about prescription charges.

All the code is on GitHub.

It was really hard to keep our demo short. We also had to resist the urge to add more and more features. When there is only 3 minutes to show off what you've learned, you've got to really concentrate on what it is you want to show off.

Anyway, huge thanks to everyone who attended and the organisers for making such an incredible weekend.

Plot twist!

@edent — Mon, 07 Jan 2019 12:53:34 +0000

A mysterious woman, with a non-London accent and blonde hair, reached out her hand. She asked me a simple, yet terrifying, question - "Do you want to come on an adventure?"

Sadly, Hadley Beeman does not have a TARDIS (Well, as far as any of us can tell...). What she does have is an interesting new job for me. Take a deep breath, because it's a heck of a long title:

Senior Technology Advisor to the Chief Technology Advisor to the Secretary of State for Health and Social Care

Sweet! So, what does a STAttCTAttSoSfHaSC do? Apart from scoring 25 points in Scrabble, obviously?

I'm going to help improve the health and social care system - within and beyond the NHS. Not all of it, and not necessarily the bits that you'll see, but some of the deep magick which runs the technology behind it.

My job will be to keep saying "Hey! Let's use internationally recognised, free and open standards. Y'know, rather than handing a single company a life-long monopoly."

I'll also occasionally point my Sonic Screwdriver at a bit of kit and say "If we reverse the polarity of the neutron flow, we may be able to replace this with Open Source Software."

This is akin to redesigning and replacing the engine of a plane, while it is in flight. Without losing altitude or causing the passengers any discomfort. While under attack from Weeping Angels.

If I'm lucky, the team will help set the course for the future of NHS technology. I'm not talking AI-powered iPhone apps to show you your polyps in virtual reality - I'm talking about your consultant being able to share data with your GP without resorting to SnapChat. Or fax.

Can we put user needs at the heart of technology standards decisions? Can we give Clinical Commissioning Groups the tools and frameworks they need to make smarter decisions about technology? Can we make things open and make things better?

There's only one way to find out...!

This is a temporary secondment. I'm grateful to the whole team at GDS for letting me go on this adventure. Much like the Meta-Crisis 10th Doctor (do keep up), this role has a limited lifespan. Looks like the 2019 season of "The Terence Eden Adventures" is going to be epic!

Allons-y, Alonso!

The Unsecured State Part 3 - 2,000+ NHS Security Vulnerabilities (Disclosed)

@edent — Wed, 05 Mar 2014 08:30:39 +0000

This is part 3 of a series of blog posts looking at the security of the UK Government's web infrastructure.

Britain's National Health Service is riddled with old and insecure WordPress-based websites. Many of these sites have severe flaws including being vulnerable to XSS attacks.

There is absolutely no suggestion that patient data or confidentiality has been put at risk.

These flaws were discovered passively using the information which was returned by the web server following a normal request. I have not exploited any of the holes found.

All these flaws were responsibly disclosed to Department of Health Officials in January 2014. Throughout February I was repeatedly in contact with various NHS officials trying to get them to do something about these problems.

This is a technical look at how I found these flaws. Please buy the latest edition of Computer Active to read the full story.

Step 0 - Was This A Problem In The Past?

In 2009, a security researcher discovered a severe security flaw in one of the NHS's websites. I wondered if the NHS had improved its web security practices in the last 5 years.

Step 1 - Get All NHS Domain Names

I initially thought there would be a public list of all the NHS's websites. There isn't. Thankfully, Rob Aley had made a Freedom of Information request a year ago which I was able to use.

The list dates from January 2013 - so it doesn't contain any of the more recent domains. However, as any WordPress site created in the last 12 months is (hopefully) free of vulnerabilities, that's not too big an issue.

So, with 5,000 domains in hand, it's on to....

Step 2 - Look for Vulnerabilities

There were five main classes of vulnerabilities I was looking for.

Old WordPress versions.
Server Information.
Directory listings.
Unsecured login pages.
XSS Flaws.

Finding the WordPress version is simple enough. Most sites will spit out a header in the HTML which says:

If the administrator is sensible enough to have hidden that header, we can still infer which WordPress release is running by looking at which JavaScript libraries are bundled with the site.

Server information means we can see if the website is running on old, unpatched software. Directory listings allow us to see all the files on the server. Better hope there's nothing confidential on there!

Unsecured login pages means that anyone can guess the address of the login page. Without suitable protection, repeated login attempts can be made until. Unless the site is running SSL (and most aren't) the username and password are sent unencrypted. Better hope no one is logging on over public WiFi!

Finally, on to XSS. The easiest way to test is to search for an HTML string and see if it is returned.

Testing each one of these manually is possible - although a right pain in the arse - so I turned to...

Step 3 - wpscan

The Open Source software wpscan is a simple tool - you give it a URL and it finds every single WordPress vulnerability on the site. It tells you the version, what bugs are present, whether the site is likely vulnerable the XSS, and all sorts of other interesting details.

Right, time to get started!

Step 4 - Scanning

Sadly, wpscan doesn't have a batch mode. Nor does it play well with parallel processing. That means running it in serial.

Taking a list of NHS domains in a .txt file, it's relatively easy to extract each one, scan it, then dump the result to a text file with the same name as the domain.

cat nhs.txt |
xargs -iURL sh -c './wpscan.rb --follow-redirection --url URL > URL.txt'

In order to stop wpscan asking me every time it couldn't find plugin directory, I patched the wpscan.rb file.

unless wp_target.wp_plugins_dir_exists?
  puts "The plugins directory '#{wp_target.wp_plugins_dir}' does not exist."
  puts 'You can specify one per command line option (don't forget to include the wp-content directory if needed)'
  print 'Continue? [y/n] '
  #unless Readline.readline =~ /^y/i
  #  exit(0)
  #end
end

With 5,000 records to check, it was bound to take some time. Thankfully, not all the sites run WordPress and wpscan only takes a second to ignore a site it can't scan.

The scan ran at about 7 URLs per minute. Meaning the whole thing was done in less than half a day.

Step 5 - Parsing The Results

Out of the 5,000 domains, 358 were identified as running WordPress.

5 were identified as running the extremely old WordPress 2.X!

How many potential XSS vulnerabilities were found? 597. Several of the sites were identified with multiple potential exploits (I say "potential" because they were not all manually checked).

After running the reports, parsing the data, summing the number of XSS, privilege escalation, open redirects, and other miscellaneous bugs - I came up with the ~~linkbait~~ conservative total that over 2,000 security bug were identified.

Step 6 - Calm Down

It's important to note that these are suspected vulnerabilities. The wpscan software isn't perfect - some of the flaws it detects may be mitigated by other measures.

Many of the problems are "Privilege Escalation" vulnerabilities. This means that the secretary who updates the opening times, may be able to assume the role of an administrator and do some serious damage. This makes it unlikely that an external malicious user could exploit these flaws.

Ok, so what about the ~4,500 sites which aren't running WordPress? Are they secure? No!

Step 7 - Look for Non-WordPress Vulnerabilities

There are a number of sites which don't run WordPress which are still vulnerable to XSS attacks.

Nearly every single site built by a particular Norfolk based company had a confirmed XSS vulnerability.

These were found by manually searching for an HTML string and seeing if it was returned unescaped.

After repeated contact, and some hand-holding, they were able to fix dozens of vulnerable sites.

Step 8 - Responsibly Disclose the Problems

It's really hard to contact the Department of Health to report these issues to them. I'm lucky enough to have some friends in the Civil Service who were able to escalate my concerns - but even then I seemed to hit a brick wall.

I tried contacting individual website owners - who mostly forwarded me on to other people who then ignored me.

I contacted the Department of Health directly and provided screenshots of the problems - no reply was forthcoming.

Finally, I contacted James Temperton, the award winning journalist from Computer Active. James was the only journalist who responded to my request for a PGP key in order to communicate securely. In the age of Snowden, it seems bizarre that computing journalists don't take the minimum amount of effort to provide a secure contact channel.

With James' help, I was able to craft this story and he was able to contact the PR people at the Department of Health. You can read James' story in the latest issue of Computer Active.

What I Learned

Many Doctors' Surgeries in an area will all use the same cheap, private sector contractors to built their site. If there's a bug in one - that bug is present in hundreds of other sites.

On 12th February, I finally heard back from someone senior within the NHS. They explained that the Department of Health has no central control over NHS websites. As a result, sites fall through the cracks as local teams change. Consequently, in many cases there is simply no way to contact the website owners.

Abandoned Sites

I've tried to disclose the flaws to the site owners and directly to the Department of Health. In some cases - such as the following - no one is responsible for the site!

I contacted the designer - he passed me on to the agency commissioned to design the website. The agency passed me on to the NHS group they did the work for - which has since been re-organised. They passed me on to the local government contact who is meant to be responsible. She cannot find out who currently controls the site.

The Department of Health, HSCIC, local government, and NHS Care Commissioning Groups are all abdicating responsibility.

So now we have a situation where the NHS has lost control of its websites. They can be used to host spam and malware, hijack their usernames and passwords, or scam patients into giving up confidential information.

Recommendations

I love WordPress - this blog runs it, as do many more sites I administer. Like any software, it needs to be kept updated and maintained.

It's clear that many NHS websites are not being actively maintained. That's a serious failing. I don't think it's an exaggeration to say that looking after a website is as important as cleaning a hospital.

Ok, maybe a bit of an exaggeration. But XSS flaws are especially pernicious when they're on a trusted domain like nhs.uk. It's clear that the fractured nature of the NHS means that private companies are free to exploit small NHS practices. Many of these vulnerable sites have been delivered by private companies with no thought of the public harm they are doing.

Earlier this year, Sam Smith asked a very important question:

It's clear that neither tiny NHS practices nor megalithic Trusts have the experience to commission and run simple websites. The ideological desire for "competition" has lead to a waste of millions of pounds of taxpayers' money and resulted in horrendous security flaws throughout the NHS.

Public health is too important to leave to the "invisible hand" of capitalism's free market. We need a strong, centralised management which can produce and enforce best-practice across the NHS's web portfolio.

It's time that the Secretary of State for Health, Jeremy Hunt, stopped trying to undermine the public sector ethos of the NHS and, instead, concentrated on making it stronger. Rather than setting the NHS up to fail via phoney "competition", he should be ensuring it works together as a community to ensure the security of the NHS's digital portfolio.

The Official Response

After raising this through multiple channels - including directly to some of the site involved and to GovCertUK - this is the official reply we got from HSCIC on 18th February.

In relation to nhs.uk sites, the HSCIC's role is to process applications to use the domain name from NHS organisations and provide permission for its use, where appropriate. However, responsibility for the maintenance and security of sites using the nhs.uk domain sits with the organisation running each website or service.
The HSCIC is currently drafting some additional guidance, in support of our existing technical guidance, to be issued to all applicants receiving permission to use the nhs.uk domain. We are grateful to the individuals who have alerted us to these issues so that we can take them into account when drawing up this document.

A Special Message To Tim Kelsey about care.data

If the NHS can't be trusted to secure their websites - why should I trust them to secure my confidential medical details?

That's why I've opted-out of care.data and you should too.

iOS Only Kills - Open Data Saves Lives

@edent — Fri, 15 Nov 2013 08:05:36 +0000

A slightly tongue-in-cheek title for quite a serious subject.

The South Central Ambulance Service NHS Foundation Trust have a list of emergency defibrillators available for public use. To help raise awareness, they've released an app...

Of course, it's iPhone and iPad only. Who cares if Android, BlackBerry, or Windows users want to save a life, right?

Rather than doing anything constructive with my day, I snarked on Twitter.

Well, how hard can it be to plot points on a map? So, I threw myself into the challenge over my lunch break. Turns out, it's really easy.

Getting the Data

The NHS provided me with a link to a Google map:

https://maps.google.com/maps/ms?authuser=0&vps=5&ie=UTF8
&hl=en&oe=UTF8&msa=0&output=kml
&msid=213551442652291377405.0004daf3ca79fc04df02e

It's really easy to get Google Maps to spit out KML. All you really need is the msid:

https://www.google.co.uk/maps/ms?ie=UTF8&hl=en&vps=1&jsv=280a
&msa=0&output=kml
&msid=213551442652291377405.0004daf3ca79fc04df02e

Hey presto - one KML file.

Drawing The Map

Google Maps is so passée - and hides some fairly nasty gotchas - so I used OpenStreetMap. I find that OpenLayers is the easiest way of making OpenStreetMap look beautiful on mobile - and it natively supports KML imports.

Finding Oneself

A user, presumably, wants to find the closest AED to where she is right now - so I wanted to geolocate the user's phone. The OpenLayers geolocation code was a bit to complex for a very quick hack, so I just went with

navigator.geolocation.getCurrentPosition(function(position) {
var lonLat = new OpenLayers.LonLat(position.coords.longitude,
                                   position.coords.latitude)
             .transform(
                new OpenLayers.Projection("EPSG:4326"), //transform from WGS 1984
                map.getProjectionObject() //to Spherical Mercator Projection
             );
   map.setCenter(lonLat, 15 // Zoom level - Not too far in, or the user may not see what's going on.
   );
});

Feedback

One satisfied customer :-)

Open Data + Open Source = Big Win For Society

Improvements

This was a quick hack, to be worked on by others with more free time. Here are some things which need changing.

The KML file is static - ideally it should be loaded dynamically from a canonical source.
Geolocation doesn't track the user. Ideally she should see if she's getting closer to an AED.
Pins could do with being bigger, and perhaps a different colour.
Needs links to official sources so the user can trust it.
Needs an icon so the user can install it to the screen of her phone.
Potential to use HTML5 to cache the KML file for offline use.

If you want to play around with the code - it is available on GitHub.

Open Letter To Jonathan Lord

@edent — Fri, 09 Mar 2012 12:27:51 +0000

(Unlike most "open letters" this one was sent to my MP using the fantastic WriteToThem. I've added hyperlinks for context.)

Dear Jonathan Lord,

I want to thank you for highlighting the inadequacy of South West Trains service from Woking. As commuters for four years, my wife and I are sick and tired of trains which are overcrowded, frequently late, and often filthy.

As the answer you received in Parliament shows, the private companies which provide train service in Woking are not looking after passengers' interests. They are expensive, inefficient and have a reckless disregard for safety.

I am therefore confused as to why the Government is pushing for the further privatisation of the NHS and Police force.

Given the disastrous privatisation of the railways that you have discovered, can I ask how you will be voting on 13 March 2012 on the debate to drop the NHS bill?

Yours sincerely,

Terence Eden

While I disagree with most of Mr Lord's politics, he's usually very good at getting back to me with sensible answers. I do wonder if the cognitive dissonance will be a problem in this instance.